CVE-2026-101536 is a vulnerability in Oracle Cost Management, part of the Oracle E-Business Suite. It affects versions 12.2.3 through 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to potentially take over Oracle Cost Management. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-101529 is a critical vulnerability in Oracle Enterprise Manager for Oracle Database, specifically in the Data Guard Management component. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability affects versions 13.5 and 24.1. The CVSS 3.1 base score is 9.9, indicating severe confidentiality, integrity, and availability impacts. Attacks exploiting this flaw may also impact additional Oracle products due to scope change. Oracle has released patches addressing this vulnerability in their October 2026 Critical Patch Update.
CVE-2026-101528 is a critical vulnerability in Oracle Enterprise Manager for Oracle Database, specifically in the Data Guard Management component. It affects versions 13.5 and 24.1. The flaw allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 9.9, indicating severe confidentiality, integrity, and availability impacts. Attacks exploiting this vulnerability may also affect additional Oracle products due to scope change. Oracle has released patches for this and many other vulnerabilities in its October 2026 Critical Patch Update advisory.
CVE-2026-101526 is a high-severity vulnerability in Oracle Enterprise Manager for Siebel, specifically in the Configuration Management component. It affects versions 13.5 and 24.1. The flaw allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released patches addressing this vulnerability as part of its October 2026 Critical Patch Update.
CVE-2026-101520 is a high-severity vulnerability in Oracle Global Lifecycle Management NextGen OUI Framework that allows an unauthenticated attacker with network access via HTTP to cause a denial of service by hanging or crashing the service. The affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0, and 15.1.1.0.0. The vulnerability impacts availability but does not affect confidentiality or integrity. Oracle has included this fix in their October 2026 Critical Patch Update, which contains numerous patches across multiple products.
CVE-2026-101517 is a vulnerability in Oracle Utilities Network Management System allowing a low privileged attacker with logon access to the infrastructure to compromise the system. Successful exploitation can lead to unauthorized access to critical or all accessible data within the system. The vulnerability affects multiple versions of the product ranging from 2.4.0.1.0 through 25.12.0.0.2. The CVSS 3.1 base score is 5.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact.
CVE-2026-101500 is a vulnerability in Oracle Global Lifecycle Management OPatchAuto affecting versions 12.2.0.1.16 through 12.2.0.1.52. It allows a high privileged attacker with logon access to the infrastructure to compromise the OPatchAuto component. Exploitation requires user interaction from a person other than the attacker. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 6.5.
CVE-2026-101474 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to potentially gain unauthorized access to critical data or all accessible data within the product, and to cause a partial denial of service. The vulnerability is rated with a CVSS 3.1 base score of 5.9, indicating medium severity, with impacts on confidentiality and availability. Exploitation is considered difficult due to the required attack conditions.
CVE-2026-101473 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows an unauthenticated attacker with network access via HTTP to potentially take over the affected product. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.1, impacting confidentiality, integrity, and availability. The vulnerability is difficult to exploit but can lead to full compromise if successfully attacked.
CVE-2026-101449 is a low-severity vulnerability in Oracle Siebel CRM Deployment (Siebel Management Console component) affecting versions 17.0 through 26.9. It allows an attacker with physical access to the system to gain unauthorized read access to some data within the Siebel CRM Deployment. The vulnerability has a CVSS 3.1 base score of 2.4, indicating limited confidentiality impact without integrity or availability effects. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which provides patches for multiple products including Siebel CRM. Users are strongly advised to apply the available patches promptly to mitigate this issue.
CVE-2026-101448 is a vulnerability in Oracle Siebel CRM Deployment's Siebel Management Console component affecting versions 17.0 through 26.9. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to some accessible data within the Siebel CRM Deployment. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact focused on confidentiality. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which provides patches addressing this and other vulnerabilities.
A vulnerability in Gaijin Entertainment's War Thunder game client allows the authentication bearer token to be transmitted in cleartext using only compression, not encryption. This enables a network attacker to intercept and impersonate the user temporarily, accessing game services and some user data. However, full account takeover and sensitive account management functions remain protected.
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. This issue is fixed in version 4.33.0.
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the special __proto__, constructor, and prototype path keys, allowing browser prototype mutation that can reach an unsafe DOM sink and execute script in the victim's session; anonymous visitors do not load the affected admin context. This issue is fixed in version 4.33.0.
CVE-2026-92539 is an authorization bypass vulnerability in Grafana Enterprise affecting instances with SCIM enabled. A service account with user-management permissions in one organization can improperly access and manipulate users in other organizations on the same Grafana instance via the SCIM API. This issue arises from insecure direct object references. The vulnerability has a CVSS score of 6.7 (medium severity) and affects multiple versions of Grafana Enterprise prior to fixed releases.
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, viewRole is not applied to anonymous visitors when a developer exposes user objects through a publicly rendered relationship or expressly enabled public API. Inadequately limited templates, including serialization of an entire related user object, can conditionally disclose user fields, but relationships do not automatically publish full user objects and password hashes are stored separately and are not affected. This issue is fixed in version 4.33.0.
CVE-2026-0257 is an authentication bypass vulnerability in Palo Alto Networks PAN-OS affecting GlobalProtect portal and gateway components. Exploitation allows unauthorized attackers to establish VPN connections without valid credentials. Ransomware groups such as Spikey Scorpius (Qilin), Tarnished Scorpius (Inc), and Settra actively exploit this flaw to gain initial network access. Post-exploitation activities include bypassing multi-factor authentication, internal reconnaissance, lateral movement via RDP and SMB, credential harvesting, and ransomware deployment. Attackers also pivot to virtualization infrastructure by accessing vCenter management appliances, disabling ESXi hypervisor security controls, and performing offline credential dumping from domain controller virtual disks. Multiple industries have been impacted. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private upload storage, or authenticated upload delivery are not exposed through this network-download path. This issue is fixed in version 3.7.1.
Modoboa versions prior to 2.8.0 contain an authorization bypass vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by manipulating the mailbox identifier. This flaw enables attackers to inject attacker-controlled auto-reply subjects and content into other users' settings or disrupt auto-reply management.
Antidetect browsers such as Kameleo, AdsPower, and MultiLogin enable threat actors to conceal their digital identities and manage thousands of isolated accounts across multiple social media and financial platforms without detection. These tools facilitate account takeovers, financial fraud, phishing, malware distribution, and coordinated influence operations by evading platform detection systems that rely on behavioral and device identity signals. The integration of AI enhances these browsers' capabilities, automating persona management and content generation at scale, reducing the need for large technical teams. These commercially available browsers have legitimate uses but are actively abused in underground criminal ecosystems. The threat is significant because accounts created or taken over via antidetect browsers can pass KYC verification and appear legitimate, making fraud detection difficult until after damage occurs.